KUBE_APISERVER_OPTS="
  --enable-admission-plugins=NamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \
  --anonymous-auth=false \
  --bind-address={{ inventory_hostname }} \
  --secure-port={{ KUB_API_SERVER_PORT }} \
  --advertise-address={{ inventory_hostname }} \
  --insecure-port=0 \
  --authorization-mode=Node,RBAC \
  --runtime-config=api/all=true \
  --enable-bootstrap-token-auth \
  --service-cluster-ip-range={{ SERVICECLUSTERIPRANGE }} \
  --token-auth-file={{ PKI_PATH }}/{{ KUB_API_SERVER_TOKEN_AUTH_FILE }} \
  --service-node-port-range=30000-50000 \
  --tls-cert-file={{ PKI_PATH }}/kube-apiserver.pem  \
  --tls-private-key-file={{ PKI_PATH }}/kube-apiserver-key.pem \
  --client-ca-file={{ PKI_PATH }}/ca.pem \
  --kubelet-client-certificate={{ PKI_PATH }}/kube-apiserver.pem \
  --kubelet-client-key={{ PKI_PATH }}/kube-apiserver-key.pem \
  --service-account-key-file={{ PKI_PATH }}/ca-key.pem \
  --service-account-signing-key-file={{ PKI_PATH }}/ca-key.pem  \
  --service-account-issuer=https://kubernetes.default.svc.cluster.local \
  --etcd-cafile={{ PKI_PATH }}/ca.pem \
  --etcd-certfile={{ PKI_PATH }}/etcd.pem \
  --etcd-keyfile={{ PKI_PATH }}/etcd-key.pem \
  --etcd-servers={% for item in groups['etcd'] -%}
    https://{{ item }}:2379{% if not loop.last %},{% endif %}
{%- endfor %} \
  --enable-swagger-ui=true \
  --allow-privileged=true \
  --apiserver-count=3 \
  --audit-log-maxage=30 \
  --audit-log-maxbackup=3 \
  --audit-log-maxsize=100 \
  --audit-log-path=/var/log/kube-apiserver-audit.log \
  --event-ttl=1h \
  --alsologtostderr=true \
  --logtostderr=false \
  --log-dir=/var/log/kubernetes \
  --v=4"
